Open monicavis opened 1 month ago
I'm having this exact same behavior on semgrep-sast
step of my pipeline. It warns about a fetch that I use in my next-auth's Credentials provider log-in. I use a simple email+password login to perform this fetch on an external API.
Versions are:
"next": "^14.2.5"
"next-auth": "^5.0.0-beta.15"
Relevant code:
import NextAuth from 'next-auth';
import Credentials from 'next-auth/providers/credentials';
import { authConfig } from './auth.config';
import { z } from 'zod';
import type { User } from '@/app/lib/definitions';
async function getUser(email: string, password: string): Promise<User | null> {
const token = btoa(`${email}:${password}`);
const response = await fetch(`${process.env.API_URL}/login`, {
method: 'POST',
headers: {
Authorization: 'Basic ' + token,
'Content-type': 'application/json',
},
});
if (response.status !== 200) {
return null;
}
const user = await response.json();
const tokenizedUser: User = {
...user,
authToken: response.headers.get('x-auth-token'),
};
return tokenizedUser;
}
export const {
auth,
signIn,
signOut,
handlers: { GET, POST },
} = NextAuth({
...authConfig,
providers: [
Credentials({
name: 'credentials',
credentials: {
email: { label: 'email', type: 'text' },
password: { label: 'password', type: 'password' },
},
async authorize(credentials) {
const parsedCredentials = z
.object({ email: z.string().email(), password: z.string().min(6) })
.safeParse(credentials);
if (parsedCredentials.success) {
const { email, password } = parsedCredentials.data;
const user = await getUser(email, password);
if (!user) return null;
return user;
}
console.log('Invalid credentials');
return null;
},
}),
],
});
Link to the code that reproduces this issue
https://codesandbox.io/p/sandbox/next-js-forked-slktwp
To Reproduce
When start my application, my header is visible in the browser. This is causing the below vulnerability issue
var whitelist = [\n "https://example.com", \n "https://example.com/sample"\n]\napp.get('/ssrf/node-ssrf/axios/safe/3', function (req, res) {\n if(whitelist.includes(req.query.url)){\n axios.get(url, {})\n .then(function (response) {\n console.log(response);\n })\n .catch(function (response) {\n console.log(response); \n })\n }\n});
For more information on SSRF see OWASP: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html\nCurrent vs. Expected behavior
Current behavior: vulnerability scan failed because of injection of headers in the URL
Expected behavior: Vulnerability scan should pass
Provide environment information
Which area(s) are affected? (Select all that apply)
Instrumentation, Output (export/standalone)
Which stage(s) are affected? (Select all that apply)
next dev (local), next build (local), Other (Deployed)
Additional context
No response